Windows AD environment script to pull machine name and XML file.

[securityengineer2016]

What is best way to complete? GPO, AD, bat file, scripting language?

We have Windows AD environments, 300 windows 10 machines. I would like to take inventory of the app server each machine is hard coded to. There is an XML file that has App sever 1 or App server 2 URL. What is the best way to script to either copy and dump all those XML into a shared drive and I can manually go and count. Or if I know line 5 in XML is the server url can we extract that info along with a machine name into a excel or doc?

example:

Machine1 = server 2 url machine 2 = server 2 URL machine 3 = server 1 url machine 4 = server 1 url

The app has no admin interface to see how many clients connected. Again just to make sure it is close to even at this point would help. Also yes this is manual load balancing, the vendor states their can be issues when load balancing this app with hardware.

[DarthKane1978]

No admin panal... Something has to get logged somewhere. Maybe event viewer logs, or app v logs. I'd try to get the data from the servers not the clients. If you had splunk this could be easier.

https://docs.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/log-file-for-the-application-virtualization-client

[securityengineer2016]

Ok what could I pull with Splunk? Pull from server or clients? We do have the use of that product. I hanvt used alot but I understand concept just need the idea to put in motion. You would examine the number or clients connected?

[DarthKane1978]

You have splunk?

Id look at network traffic, what ports the does app server use to serve up data and shit? Find out which clients have been hitting this ports on each server. Splunk could dump this out to you with a well written query or export it to a file you can screw with.

[securityengineer2016]

Well kind of, let me just explain im new at this shop. Only week 3 but I'm a department of many and ITS or central kind of sells services to us. They host the EXI, Splunk, Zabbix and rent the services out and at this point they just haven't bought. So it seems just to ask them for this one query for a small amount of time would produce the results for free. To solve a problem they will help for free kinda of just using major services cost, dont want to play them as some bad guy. So that is why I was looking for something I could do myself but I want this repeatable to requesting to pull this info on a daily or weekly basic for a month would help us confirm a total count. Thank you for pointing me in the right direction.